Loading story…
ESET researchers uncovered dozens of fake WhatsApp and Telegram websites distributing trojanized Android and Windows installers aimed largely at Chinese-speaking users trying to access blocked messaging services outside official app stores. The malicious Android apps included the first observed clipper malware embedded in instant messaging clients, replacing cryptocurrency wallet addresses in chats so funds would be redirected to attacker-controlled accounts. Some samples also used OCR to scan screenshots and photos for wallet recovery phrases, while other variants exfiltrated messages, Telegram data, device details, and files.
On Windows, the campaign delivered both Telegram clippers and bundled remote access trojans (RATs) that enabled keylogging, clipboard theft, screen capture, and file operations. Victims were lured through Google Ads, fraudulent YouTube channels, and counterfeit download pages impersonating legitimate messaging services. ESET said the operation reflects a broader cryptocurrency-theft ecosystem built around fake messaging apps and reported the malicious ads and channels to Google, which removed them.
Track how attackers are adapting to this technology.
4 events from the most recent confirmed update back to the earliest known activity.
After ESET reported the campaign's malicious Google Ads and fraudulent YouTube channels to Google, the company removed them. This action disrupted part of the distribution infrastructure used to lure victims to counterfeit download sites.
ESET found Windows-based fake Telegram and WhatsApp installers containing clippers that alter cryptocurrency wallet addresses in messages as well as bundled remote access trojans. The RAT functionality included keylogging, clipboard theft, screen capture, and file operations.
ESET reported Android malware embedded in fake messaging apps, including the first observed clippers in instant messaging apps that replace cryptocurrency wallet addresses in chats. Some samples also used OCR to scan screenshots and photos for wallet recovery phrases, and ESET grouped the threats into four Android clusters with varying theft capabilities.
ESET researchers identified dozens of fake Telegram and WhatsApp websites distributing trojanized Android and Windows apps, primarily targeting Chinese-speaking users seeking blocked services outside official channels. The campaign used Google Ads, fraudulent YouTube channels, and counterfeit download sites to lure victims.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 75 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Follow how adversaries are adapting to this technology, and where it touches your stack today.
3 references tracked. Mallory keeps watching after this page renders.
welivesecurity.com
Open sourceattack.mitre.org
Open sourceattack.mitre.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers have identified a large-scale fraud operation dubbed **FEMITBOT** that abuses Telegram bots and **Mini Apps** to run cryptocurrency scams, phishing campaigns, and brand-impersonation schemes inside Telegram. The operation presents convincing in-app experiences through Telegram's built-in browser, including fake dashboards, fabricated account balances, urgent offers, and withdrawal prompts designed to pressure victims into depositing funds or completing referral tasks. Investigators linked the campaigns through shared backend infrastructure, including recurring API response patterns, and found that operators can quickly swap branding, languages, and scam themes spanning fake crypto platforms, financial services, AI tools, and streaming sites. The same infrastructure has also been used to distribute malicious Android **APK** files and progressive web apps disguised as legitimate software and trusted brands, including **BBC, NVIDIA, CineTV, CoreWeave, Claro, Apple, Coca-Cola,** and **Disney**. Researchers said the APKs are often hosted on the same domains as campaign APIs, helping maintain valid TLS certificates and reducing browser warnings, while embedded Meta and TikTok tracking scripts monitor victim behavior and help optimize scam performance. The findings highlight Telegram Mini Apps as an effective delivery channel for both financial fraud and Android malware, particularly when users are persuaded to sideload apps or trust investment offers promoted through bots.
Jun 29, 2026
Researchers reported that monetized URL shortener services and fake download pages were used to push **Android/FakeAdBlocker** and other malicious Android apps disguised as ad blockers or popular applications. Victims were funneled through aggressive advertising chains and prompted to install APKs with misleading names such as `adBLOCK app.apk`, after which the malware hid its icon, contacted command-and-control infrastructure, and fetched additional payloads. ESET said the campaign generated more than **150,000** Android downloads in the first half of 2021, while iPhone users were steered into fraudulent calendar-subscription scams rather than direct malware installs. The Android infections did not stop at adware. Researchers said the delivery chains also deployed banking trojans including **Cerberus**, **Ginp**, and **TeaBot**, alongside SMS trojans and other payloads, making the outcome dependent on the victim's region and the operators' current configuration. Separate reporting on Cerberus and Ginp described both as mobile banking malware families, and Bitdefender documented similar lures using mockups of well-known apps to spread **TeaBot** and **FluBot**, underscoring a broader ecosystem in which deceptive mobile install flows are used to distribute credential theft, financial fraud, and messaging abuse malware on Android.
Aug 14, 2026
Researchers reported that a malicious modified version of WhatsApp was being distributed through seemingly legitimate Android applications, allowing attackers to compromise users who installed the software outside official channels. The campaign relied on repackaged apps that appeared benign but delivered a trojanized WhatsApp mod, expanding the reach of malware through trusted-looking distribution paths rather than direct phishing alone. The activity highlights the risk posed by unofficial messaging clients and third-party app ecosystems, where attackers can hide malware inside popular software variants to steal data, abuse device access, or deploy additional payloads. The incident underscores that users and organizations should restrict installations to official app stores and vetted software sources, especially for high-use communications platforms such as **WhatsApp**.
Jul 12, 2026